Wireshark packet capture and common filtering methods

1. Packet capture

When you actually encounter an error reporting problem between component services, you cannot quickly see the reason through the log. You can quickly view the interface return information and error prompts by capturing packets. Use the following commands to capture packets on a port:

tcpdump -i any -w /opt/xxx.pcap tcp port 8150 # 8150 is the port number of the calling interface

Second, common filtering methods

After capturing the tcp protocol packets through the above command, use Wireshark to open the xxx.pcap file, and enter the corresponding filter expression in the filter box (Fileter) to quickly filterThe request message between the interfaces you want to see:

1. Filter source (source) ip and destination (destination) ip

Enter in Filter: ip.src==127.0.0.1, which can filter out the packet information whose source ip is 127.0.0.1;

Enter in Filter: ip.src==127.0.0.1, which can filter out the message information whose target ip is 127.0.0.1;

Enter in Filter: ip.src==127.0.0.1 and ip.dst==127.0.1.1, which can filter out the source ip as 127.0.0.1 and the destination ip as127.0.1.1 message.

2. Port filtering

Enter in the Filter: tcp.port==80, filter out the source port and the destination port are 80;

Enter in Filter: tcp.dstport==80, only filter the target port of 80;

Enter in Filter: tcp.srcport==80, only filter the source port of 80.

3. Protocol filtering

Enter in Filter: the protocol name and press Enter.

4. Request protocol filtering

Enter in Filter: http.request.method=="GET", filter the get mode message;

Enter in Filter: http.request.method=="POST" to filter post-mode messages.

5. Connector and

When filtering two conditions, you can use and connection:

Enter ip.src==127.0.0.1 and http in Filter to filter out packets with source ip of 127.0.0.1 and http protocol at the same time.